How to connect to Lexware Office

Lexware Office (formerly lexoffice) authenticates with a single Public API key that you create yourself inside your own Lexware Office account. There is no OAuth sign-in screen and nothing to authorize: you generate one key in Lexware Office and paste it into Vault.

Entering the key takes seconds. The two things worth reading before you start are the plan requirement and the key's expiry date — both are covered below.

Prerequisites

A Lexware Office account on the XL plan. The Public API is only available from version XL upwards. On the S, M and L plans the API-key screen will not issue you a key at all, so this is an eligibility requirement rather than a step you can work around. If you are on a lower tier, upgrade in Lexware Office (or ask whoever manages the subscription to) before continuing — see Lexware Office pricing for the current plans.
Administrator rights in that Lexware Office account. Key creation lives in the account's add-on settings, so a user without admin rights will need an administrator to create the key and hand it over.

1. Create your API key in Lexware Office

Sign in to Lexware Office and open the Public API screen at https://app.lexware.de/addons/public-api (in the app: Einstellungen / Settings > Public API).
Click API-Schlüssel erstellen ("Create API key").
Choose the key's permissions. Lexware Office offers two routes:
- Full access — a key that reaches every Public API endpoint. This is the simplest choice and the one that guarantees every resource this connector supports will work.
- Custom permissions — read/write access defined per area. If you pick this, see "Which permissions the connector needs" below.
Copy the generated key. Lexware Office displays the key exactly once and cannot show it again, so copy it before you leave the screen — paste it straight into Vault (step 2) or store it somewhere safe. If the value is later lost or mistyped, the only remedy is to create a new key.

Treat the key like a password. Anyone holding it can read and write the accounting data in your Lexware Office account.

Permissions are fixed at creation. Lexware Office does not let you edit an existing key's permissions afterwards. If a restricted key turns out to be too narrow, create a brand new key with the permissions you need via API-Schlüssel erstellen — the kopieren ("copy") option does not help here, because a copy is issued with its predecessor's permissions. The old key keeps working until its own expiry, so you can swap at your convenience.

Which permissions the connector needs

If you issue a full-access key you can skip this. For a custom-permission key, the connector reads and writes across these areas of your Lexware Office account:

Area in Lexware Office	Used for
Contacts	Customers and suppliers
Vouchers / invoices	Invoices, credit notes and bills
Posting categories	Ledger accounts (read-only)
Event subscriptions	Webhooks, if your integration uses them

Two consequences worth knowing:

Contact access is required to connect at all. Saving the connection triggers a validation call that lists your contacts. A key that cannot read contacts will fail validation even if every other permission is present.
Event-subscription access is required for webhooks. Apideck registers and removes the webhook subscriptions in Lexware Office for you through the vendor's own API, using this key. A key without that permission still syncs data, but webhooks will not be set up.

2. Connect in Vault

Open Vault and select Lexware Office.
Paste your key into the API Key field — it is the only field on the form.
Click Save.

Apideck validates the connection immediately by listing your contacts. If that call succeeds the connection becomes usable; if it fails the connection stays invalid — see Troubleshooting.

Notes

Your key expires — mark the date. Lexware Office caps API key lifetime at a maximum of 24 months. At expiry the key is deactivated and deleted, and the connection stops working with no action on the Apideck side. Before that date, open the Public API screen and either:
- verlängern ("extend") the key, which pushes the expiry out by another 24 months and leaves the key value unchanged — nothing to re-paste in Vault; or
- kopieren ("copy") the key, which mints a new key with the same permissions. The old key stays valid until its own expiry, so you can paste the new value into Vault at your convenience and swap without downtime.
Extending is the lower-effort path precisely because the key value does not change. Put a reminder in your calendar ahead of the expiry date — Lexware Office shows it on the API key screen.
One key, one account. The key is scoped to the Lexware Office account it came from. A separate account needs its own connection.
Testing without touching live books. See the Overview tab for sandbox availability. To try a connection before pointing it at real books, see the Lexware Office developer documentation for how to create a free test account.
You can disconnect at any time from Vault, and you can delete the key in Lexware Office independently — either action stops the connector's access.
Service status. Lexware publishes incidents and maintenance at https://status.lexware.de, which is worth checking before investigating a sudden run of failures.

Troubleshooting

There is no way to create a key on the Public API screen

Almost always the plan tier. The Public API is available from Lexware Office version XL upwards; on S, M or L the screen will not issue a key. Check the account's current plan in Lexware Office, and upgrade it (or ask the subscription owner to) if it is below XL.

If the account is on XL and you still cannot create a key, your user most likely lacks administrator rights — ask an administrator on the account to create the key and pass it to you.

The connection will not turn valid after saving

Re-check the value you pasted. A trailing space or a partially selected value is the most common cause, and the key is masked in Vault so the mistake is hard to spot. Lexware Office shows a key only once and cannot display it again, so if you no longer have the exact value to compare against, create a new key on the Public API screen (step 1) and paste that instead.
Confirm the key has not expired or been deleted on the Public API screen.
Confirm the key came from the Lexware Office account whose data you expect to sync.
If the key is restricted, confirm it includes read access to contacts — validation lists contacts, so a key without that permission fails to validate regardless of what else it can reach.

The connection worked and then stopped

Check the key's expiry date first. A key that reached its 24-month cap is deactivated and deleted automatically, which ends the connection without any change on your side or ours. Create or extend a key on the Public API screen, and paste the new value into Vault if the key value changed.

Failing that, the key may have been deleted manually in Lexware Office, or the account's plan may have dropped below XL.

Some resources return no data or refuse writes

If you issued a custom-permission key, compare the permissions you selected against the table in step 1 — permissions cannot be edited after creation, so a key that is too narrow has to be replaced by creating a brand new key with the right permissions. Copying the existing key will not widen it: a copy is issued with its predecessor's permissions.

Webhooks are not arriving

Confirm the key includes event-subscription permissions. Apideck creates the subscriptions in Lexware Office through the vendor's API using your key, so a key without that permission leaves the subscriptions unregistered while ordinary data sync continues to work.

Still stuck

For anything on the Lexware Office side — plan tier, administrator rights, key creation or expiry — contact Lexware Office support through the Public API help article. For anything on the Apideck side, contact Apideck Support.